sysop@hub:~/privacy$
privacy
Last updated: October 2026
1. Controller
Nico Christiansen
Neue Str. 62
27576 Bremerhaven
Germany
Email: admin-hub.xyz@protonmail.com
2. Overview
You can use this site without registering.
Most tools on this site run entirely in your browser. Text, files and other data you enter into these tools are processed locally on your device and are not transmitted to us, except where a tool explicitly contacts an external service as described in section 5.
We do not use advertising, analytics or tracking technologies.
3. Hosting and server log files
This website is provided using services from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
When you visit the site, Cloudflare processes technical connection data required to deliver and protect the website. This may include your IP address, date and time of access, the requested page, browser and device information and similar technical data.
The purpose of this processing is to deliver the website, maintain its security, prevent abuse and ensure reliable operation. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and efficient operation of this website.
Cloudflare acts as a service provider for the delivery and protection of the website. We do not maintain separate visitor profiles from these connection data. Technical logs are retained only for as long as necessary for security, troubleshooting and operation of the service, subject to the retention periods applicable to the Cloudflare services used.
Cloudflare may process data outside the European Economic Area, including in the United States. According to Cloudflare, international transfers are protected, where applicable, by mechanisms including the EU-U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses.
4. Cookies, local storage and offline cache
This site does not set cookies and does not use advertising, analytics or tracking technologies. For this reason, no consent banner is displayed.
Some functions store small amounts of information in your browser's localStorage or sessionStorage. This is done only where necessary to provide a function you have requested. The legal basis for storing or reading this information on your device is Section 25(2) no. 2 TDDDG.
Data in sessionStorage is normally removed when you close the browser tab. Data in localStorage remains on your device until it is deleted by the site, by you through a provided control, or through your browser settings. None of it is transmitted to us.
| Key | Where | What it holds |
|---|---|---|
ah_lang | localStorage | the language you chose in the header (section 8) |
ah_crt | localStorage | the optional CRT display effect, if you switched it on |
ah_cockpit_on, ah_cockpit | localStorage | the cockpit, only if you enabled it (section 9) |
ah_assets_on, ah_assets | localStorage | the asset inventory list, only if you ticked "Keep the list in this browser" |
ah_lic_on, ah_lic | localStorage | the licence tracker list, only if you ticked "Keep the list in this browser" |
ah_tr_... | sessionStorage | translated phrases of the page, so they are not translated twice |
ah_lp, ah_ps, ah_sql, ah_pj | sessionStorage | your progress and typed commands in the Linux, PowerShell and SQL playgrounds and the packet journey |
ah_ca_built | sessionStorage | a policy handed from the Conditional Access policy builder to the analyzer |
The site can be used offline. For this, a service worker keeps copies of the site's own pages, scripts, styles and fonts in your browser's cache storage. It stores nothing that you enter and contacts no server other than this site. You can remove it by deleting the site data in your browser.
Some planners (for example the network diagram builder, the rack planner and the PC build checker) keep their state in the address of the page, after the # sign, so that you can bookmark or share it. This part of an address is not sent to the server by your browser. Whoever receives the link from you can see its content.
5. Tools and local processing
Unless stated otherwise below, text, files and other information that you enter into the tools are processed locally in your browser and are not transmitted to us or to another server.
Please do not enter secrets, confidential information or personal data that you are not authorised to process.
The following tools contact external services, and only when you actively start the relevant function.
5.1 DNS lookup, domain check and DMARC report reader
The DNS lookup and the domain check send the domain name you enter to a public DNS resolver using DNS-over-HTTPS: Cloudflare DNS (cloudflare-dns.com, Cloudflare, Inc.) or Google Public DNS (dns.google, Google LLC). In the DNS lookup you choose the resolver.
In the DMARC report reader, the button that looks up host names sends the IP addresses of the sending servers listed in your report to Cloudflare DNS. The report itself is not transmitted.
The provider receives the requested name or address and the technical connection data, such as your IP address, that is necessarily transmitted when your browser connects to it. The purpose is solely to perform the lookup you requested. Nothing from these requests is sent to us.
The provider processes the request under its own privacy terms and retention policies. Depending on the provider, processing may take place outside the European Economic Area.
5.2 Password breach check
The breach check in the password strength tool uses the Pwned Passwords service of Have I Been Pwned.
Your password itself is never transmitted. It is hashed locally in your browser using SHA-1. Only the first five characters of that hash are sent to api.pwnedpasswords.com. The service returns possible matching hash endings, and the comparison is performed locally in your browser. This method is designed so that the provider receives neither your password nor its complete hash.
When the request is made, the provider also receives technical connection data such as your IP address. Have I Been Pwned is operated by Superlative Enterprises Pty Ltd, Queensland, Australia. Processing may therefore involve a transfer outside the European Economic Area.
The check is made only when you use this function. Nothing from this request is sent to us.
5.3 Connectivity check
The connectivity check in the status center requests small test resources from several Microsoft endpoints (among them login.microsoftonline.com, outlook.office365.com, graph.microsoft.com, teams.microsoft.com, www.office.com and portal.azure.com) to determine whether your browser can reach them.
When you start the check, your browser connects directly to these Microsoft servers. Microsoft therefore receives technical connection data such as your IP address and browser information. No files or content that you entered into admin_hub are transmitted as part of this check.
The check is made only when you start it. Nothing from these requests is sent to us. Microsoft may process data outside the European Economic Area in accordance with its own privacy terms and applicable transfer safeguards.
5.4 News and external links
The headlines on the news page and the list of exploited vulnerabilities are collected from public feeds by an automated job on the server side and published as part of this site. Your browser does not contact those sources when you read the page.
The site contains many links to external websites. An external site receives data only when you follow such a link.
6. Fonts
This site does not load fonts from external font services. IBM Plex Sans and JetBrains Mono are provided directly by this website. Your browser therefore does not contact Google Fonts or another external font provider in order to display them.
7. Advertising, analytics and tracking
This website contains no advertising. We do not use advertising networks, visitor analytics, tracking pixels, behavioural profiling or cross-site tracking. We do not create advertising profiles about visitors.
8. Language and translation
The website is written in English. If you choose another language in the header, your selection is stored in your browser under the localStorage key ah_lang so that the following pages use the same language. Translated phrases are kept in sessionStorage until you close the tab.
The translation is performed on your device by a translation function provided by supported browsers such as Chrome or Edge on desktop. Depending on your browser, it may download a language pack from the browser vendor. The text of the page is not sent to us as part of this process.
If your browser does not provide this function, the site shows a link to Google Translate. Google is contacted only if you open that link. In that case, Google receives at least the address of the page and normal technical connection data.
The legal basis for storing or reading this information on your device is Section 25(2) no. 2 TDDDG.
9. Cockpit and saved lists
The cockpit is disabled by default. If you enable "Remember my results on this device", some tools store a short summary of their results in your browser's localStorage (ah_cockpit, ah_cockpit_on). This may include a domain you checked, a result grade, result counts and titles of findings. Log files, policies and user names that you analyse are not stored by the cockpit.
You can delete the stored summaries with "Forget everything", by switching the feature off, or by deleting the site's data in your browser.
The asset inventory and the licence tracker work the same way: only if you tick "Keep the list in this browser" is the list you entered stored in localStorage, and unticking the box deletes it. Such a list may contain personal data that you enter yourself, for example the names of users of devices.
This information remains in your browser and is not transmitted to us. The legal basis for storing or reading this information on your device is Section 25(2) no. 2 TDDDG.
10. Contact by email
If you contact us by email, we process the information contained in your message, your email address and any other information you voluntarily provide in order to respond to your enquiry.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is communicating with visitors and responding to enquiries. Where your enquiry concerns entering into or performing a contract, the legal basis is additionally Art. 6(1)(b) GDPR.
Email is provided using Proton Mail, operated by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. Proton processes the technical and account-related data required to provide the email service. Switzerland is recognised by the European Commission as providing an adequate level of protection for personal data.
We retain correspondence only for as long as necessary to handle your enquiry and any subsequent communication. Information may be retained for longer where this is required by law or necessary for the establishment, exercise or defence of legal claims.
11. Recipients of personal data
We disclose personal data only where this is necessary for the purposes described in this privacy policy, where you initiate communication with an external service through one of the tools, or where we are legally required to do so. Depending on how you use the website, recipients may include:
- Cloudflare, for hosting, delivery and protection of the website
- Proton AG, for email communication
- Cloudflare or Google, if you use a tool that queries their DNS resolver
- Superlative Enterprises Pty Ltd (Have I Been Pwned), if you use the password breach check
- Microsoft, if you start the connectivity check
These services receive only the data necessary for the respective request as described above.
12. International data transfers
Some service providers used by this website are located outside the European Economic Area or may process data there. Where the GDPR requires safeguards for such transfers, the respective provider may rely on an adequacy decision, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses approved by the European Commission, or another transfer mechanism permitted under Chapter V GDPR. The relevant mechanism depends on the provider and the processing activity concerned.
13. Your rights
Where the requirements of the GDPR are met, you have the right to:
- obtain information about personal data concerning you (Art. 15 GDPR)
- have inaccurate data corrected (Art. 16 GDPR)
- request deletion (Art. 17 GDPR)
- request restriction of processing (Art. 18 GDPR)
- receive data in a portable format where Art. 20 GDPR applies
- object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR)
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for private organisations based in Bremerhaven is:
Der Landesbeauftragte für Datenschutz und Informationsfreiheit
der Freien Hansestadt Bremen
Georgstraße 122–124
27570 Bremerhaven
Germany
Email: office@datenschutz.bremen.de
You may also contact another competent supervisory authority, in particular in the EU Member State of your habitual residence or place of work.
14. Obligation to provide data
There is generally no statutory or contractual obligation to provide personal data when using this website. Certain technical data, in particular your IP address, must necessarily be processed in order for a website or external service to communicate with your browser. If you contact us by email, we need sufficient contact information to respond.
15. Automated decision-making
We do not use personal data for automated decision-making or profiling within the meaning of Art. 22 GDPR. Results produced by the tools are technical analyses generated from the input and the rules of the respective tool. They are not used by us to make decisions about individuals.
16. Security
We use appropriate technical measures to protect this website and communications with it against loss, misuse and unauthorised access. Communication between your browser and this website is encrypted using HTTPS. Because the tools process their inputs locally in your browser, those inputs are not transmitted to our servers.
17. Changes to this privacy policy
We may update this privacy policy if the website, its tools, service providers or legal requirements change. The current version is always available on this page.